Tag Info

Hot answers tagged


This claim is bogus. DES itself has a 13-round differential with probability around $2^{-47}$, so TripleDES with its 48 rounds is resistant to any sort of differential attack. The paper authors are not really confident in the subject.


Your fault attack scenario correspond to this paper : A Differential Attack Technique Against SPN Structures with Application to AES and KHAZAD (Piret & Quisquater - CHES 2003) This paper describe how to retrieve four bytes of the last round key with at least two pairs of ciphertext/faultytext. Each pair of ciphertext $C$ and faultytext $C^*$ could be ...


Probably the biggest vulnerability is that the message expansion is too linear. The linearity of the SHA-1 message expansion is why we are able to find such good differential paths. There can be differences at the beginning of the message and by the end of the message expansion they are mostly canceled out.


This is known as the "key complementation" property of DES; I had thought that it actually predated Biham and Shamir's work. In any case, your questions: Does this hold for only that particular combination of s box or it will be same for any S-box combination It'd remain even if you change the sbox's arbitrarily. The reason for this is that it is not ...


With DES, the issue is the size of the s-box. The DES s-boxes are highly tuned for their security properties, but if you compare their nonlinearity to the larger AES s-box, the are quite inferior. Note than random s-boxes and key dependent s-boxes are not the same thing. Random = fixed random, key dependent = permuted s-boxes based on the key. A random set ...


XORing with a key indeed does not change the difference. But usually before the XORing there is nonlinear layer (Sboxes?) which changes the difference. For example $(N rounds...)(Sbox)(AddKey)$. You can use a differential up to the beginning of this layer. Then, for different subkeys you will get same sbox output differences, but the sbox input differences ...


Your calculations are correct. The 2nd table has 2 entries of 6 in its DDT, and 18 entries of 4. The Hamsi s-box has 24 entries of 4. What can you infer from these tables? First off, CryptWizard001 is a liar. Second, the larger the max value in the DDT, the more vulnerable the s-box is to differential cryptanalysis, therefore the modified s-box does not ...

Only top voted, non community-wiki answers of a minimum length are eligible